0

We are using an encryption appliance that is capable of creating S/MIME certificates for internal users. The appliance is synchronizing with AD to get the user. When the certificate is created it will contain all users smtp mail addresses configured on Exchange for this particular user.

Later e-mail addresses do NOT appear in certificate

After the certificate is created and we add another mail address for the same user we can see that the mail address is added as a property for the user account on the appliance but the certificate is not changed. I was thinking maybe it's by design that it's not possible to modify an existing S/MIME certificate (tried to find something in RFC's but without luck).

Anyone ?

I think it's the value that is controlling it

X509v3 Subject Alternative Name: 
    email:test_new@example.de, email:testnew@example.de,
Improve this question
4
  • What encryption appliance? Why do you care/i.e.: what breaks? What does the vendor say about this?
    – StackzOfZtuff
    Jun 23, 2016 at 7:47
  • it's Symantec Encryption management Server. I care because my users they have few smtp addresses associated with their accounts e.g test_new@example.de, email:testnew@example.de if they add a third e-mail address like tnew@example.de the certificate can't be used to encrypt the traffic using the 3rd e-mail address because the X509v3 Subject Alternative Name is not getting updated.
    – cyzczy
    Jun 23, 2016 at 7:51
  • Also will editing the cert with openssl change it's hash? I mean would I have to prvide the public portion of the cert again to 3rd parties ?
    – cyzczy
    Jun 23, 2016 at 8:14
  • 1
    Changing anything in a certificate invalidates the signature on it; the whole point of a certificate is that the relier trusts it because it is signed by the (trusted) CA, and only the CA can 'change' the contents by issuing a new certificate with different contents. And yes if you want reliers to use a new cert, you have to provide the new cert to them.
    – dave_thompson_085
    Jun 23, 2016 at 11:36

1 Answer 1

Reset to default
1

You cannot change the certificate but you can revoke it and issue a new one; or, keep the old one and let it expire on its own while issuing a new certificate for future email messages. The issue with revoking a certificate would be errors occurring if a mail client checks for revocation. To avoid this you can just leave the early certificate as valid and issue a new one as well. Any new email messages would be signed with the new certificate containing all of the email addresses.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .